Hi all,

There is a new SecureFiles (v0.21) available here:

http://silverstripe.org/secure-files/

There have been a number of improvements:

You can now apply decorators in your _config to decide how you want Secure Files to manage permissions. From the base install, only ADMINS and users with the SECURE_FILES permission will be able to access secure files. You can then apply the Group Permission Decorator or Member Permission Decorator (or both) to add the functionality you want.

It's also easy to extend - simply create a new decorator that implements canViewSecured() and you can add new permission systems.

Should be compatible with 2.3.x and 2.4b

Translations would be welcome.

Future enhancements:

• -Time restricted permissions
  
• -Auth Token permission - provide an auth token to access a particular file. Useful for 'paid content' systems
  
• -Access logging
  
• -GUI improvements within the CMS
  

Note: this is not the same module that is available via svn.silverstripe.com or open.silverstripe.com.

See latest updates at: http://polemic.net.nz/svn/silverstripe/modules/SecureFiles/trunk/
tickets etc at: http://polemic.net.nz/trac/

Regards
Hamish

The silverstripe.com one is a fork of an earlier version - I don't know who is responsible for ongoing maintenance.

The version available at http://silverstripe.org/secure-files/ has a number of modes of operation and is 'developer friendly' in that you can add new permission rules easily. I'm also making sure it is v2.3 and v2.4 compatible.

Have you ticked "folder is secure" and saved the folder? This will write an htaccess file that sets up the required rules.

Also, you'll still have access if you're an Admin user.

Hi, Hamish,

Yes, the folder is marked as secure. Here's the .htaccess in my secure "Uploads" folder:

RemoveHandler .php .phtml .php3 ,php4 .php5 .inc
RemoveType .php .phtml .php3 .php4 .php5 .inc
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^(.*)$
RewriteRule (.*) sapphire/main.php?url=%1&%{QUERY_STRING} [L]

Is that right?